1
SECURITY TEST Data flow -- Can you establish an audit trail for data, what goes where, is data in transit protected, and who has access to it? Data storage -- Where is data stored, and is it encrypted? Cloud solutions can be a weak link for data security. Data leakage -- Is data leaking to log files, or out through notifications? Authentication -- When and where are users challenged to authenticate, how are they authorized, and can you track password and IDs in the system? Server-side controls -- Don't focus on the client side and assume that the back end is secure. Points of entry -- Are all potential client-side routes into the application being validated? 2
EXTRA FUNCTIONAL VS Non-FUNCTIONAL TEST Unit Testing Smoke testing / Sanity testing Integration Testing (Top Down, Bottom up Testing) Interface & Usability Testing System Testing Load and Performance Testing Ergonomics Testing Stress & Volume Testing Compatibility & Migration Testing Data Conversion Testing Regression Testing Penetration Testing Pre User Acceptance Testing (Alpha & Beta) User Acceptance Testing White Box & Black Box Testing Operational Readiness Testing Installation Testing Security Testing FUNCTIONAL NON- FUNCTIONAL 3
Platform/OS TEST Different OS ->Android, IOS, Windows Different browsers -> Firefox, Google Chrome, IE, Safari Different Screen Size and resolution OS versions and memory size Hardware capable of interrupt handling without getting hanged Multilingual Support Different Time Zones Support 4
EXTRA ACCESABILITY TEST ( What is SCREEN READER?) Mobile Accessibility is critical to reaching all audiences. A product is accessible when a person with a disability can have an experience equivalent to that of a person without a disability Users who are blind will use a screen reader to navigate and access information on mobile devices. The screen readers are included in the device operating system and can be turned on in the device settings. When Screen Reader is turned on, the gestures and keyboard shortcuts change. In the 2014 Webaim survey shows that 82% of Screen Reader users will use a mobile device 5
EXTRA ACESSABILITY TEST ( SCREEN READER) Web Content Accessibility Guidelines (WCAG) A person who is blind using a screen reader or a talking browser can navigate your information and interact with it. A person with low-vision can magnify the screen and understand the content. A person who is deaf or hard-of-hearing can read captions in multimedia presentations. A person with a dexterity limitation can use the alternative input devices for all interaction, or can use speech recognition software. Screen reader testing on mobile Zooming site/application Color ratios A person with ADHD or dyslexia can use and understand the content and complete tasks Please refer to this link to learn more https://www.w3.org/tr/wcag20/ Readability of the site Navigation 6
Security Test EXTRA Workshop : ANSWER THESE QUESTIONS 1. What do you consider to be the biggest security issues with mobile phones? 2. How seriously are consumers and companies taking these threats? 3. What can be done about these threats? 7
Ways your Device might be compromised by a hacker? 8
Security Test EXTRA Attacks on mobile devices range in volume and severity, but all have the potential to cause chaos at both a device and network level. Just like in the conventional fixed Internet world, attacks come in all shapes and sizes such as: Phishing (criminals attempt to trick users into sharing passwords etc) Spyware (tracks user s activity, perhaps selling data to advertisers) Worms (a program that copies itself onto multiple devices via network connections) Trojans (a program that looks genuine but hides malicious intent) Man-In-The-Middle Attacks (where a criminal intercepts and manipulates messages between two devices or device and computer). 9
Security Test EXTRA The Mobile Code Security Stack The mobile code security stack can be broken up into four distinct layers. Each layer of the mobile code security model is responsible for the security of its defined components and nothing more. The upper layers of the stack rely on all lower layers to ensure that their components are appropriately safe 10
Security Test EXTRA Mobile Device Risks at Every Layer NETWORK HARDWARE OS Example : Your device isn t rooted but all your email and pictures are stolen, your location is tracked, and your phone bill is much higher than usual. APPLICATION 11
Security Test EXTRA What is OWASP? The Open Web Application Security project is an online community which creates freely-available articles, methodologies, documentation, tools, and technologies in the field of Web App Security OWASP Top Ten: The Top Ten was first published in 2003 and is regularly updated. Its goal is to raise awareness about application security by identifying some of the most critical risks facing organizations. The Top 10 project is referenced by many standards, books, tools, and organizations, including MITRE, PCI DSS, Defense Information Systems Agency, FTC, and many more. CWE COMMON WEAKNESS ENUMERATION : https://cwe.mitre.org/about/ 12
Security Test EXTRA- OWASP TOP TEN There are two main categories of mobile code security risks: MALICIOUS FUNCTIONALITY The category of malicious functionality is a list of unwanted and dangerous mobile code behaviors that are stealthily placed in a Trojan app that the user is tricked into installing. Users think they are installing a game or utility and instead get hidden spyware, phishing UI or unauthorized premium dialing. VULNERABILITIES. The category of Mobily Security vulnerabilities are errors in design or implementation that expose the mobile device data to interception and retrieval by attackers. Mobile code security vulnerabilities can also expose the mobile device or the cloud applications used from the device to unauthorized access. 13
Security Test EXTRA- OWASP TOP TEN 2017 A1-Injection A2-Broken Authentication and Session Management A3-Sensitive Data Exposure A4-XML External Entities (XXE) A5-Broken Access Control A6-Security Misconfiguration A7-Cross-Site Scripting (XSS) A8-Insecure Deserialization A9-Using Components with Known Vulnerabilities A10-Insufficient_Logging&Monitoring 14
EXTRA SUMMARY 26
Mobile Test Industry Standards : LETS PRACTICE 27
Mobile Test Industry Standards : LETS PRACTICE How to Start Testing a Mobile Page Find and divide page into components/modules Create a list/table of modules/testing types/ testing Create a variety of variables and conditions within each module Specify the Expected and leave place for Actual Results FOR TROUBLESHOUTING Create a list/table to view ANY problem from different angels Create a Check List for Testing Categories: Functionality Testing Usability testing Interruption testing Connectivity testing Compatibility testing Performance testing Security testing 28
Mobile Test Industry Standards : LETS PRACTICE Consumers behaviour only on the basis of Testing Strategies for Mobile Appsby: LETS experience delivered app PRACTICE 29
GUI TEST Checklist Navigation Default and shortcut keys Formatting Tab Color and fonts Opening input Scrolls Alternatives Controls and alignments Behavior Spelling and grammar Modality and multiple windows Justification Contrast Look and feel Images 30